Input Validation and Logic

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. Etherpad Lite <1.6.4 - Admin Authentication BypassCVE-2018-9845Etherpad · 13% likely

   CWE-178

2. node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.CVE-2018-6835Etherpad · 2.3% likely

   CWE-20

3. Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, M…CVE-2018-9327Etherpad · 1.6% likely

   CWE-20

4. In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could…CVE-2020-22784Etherpad · 1.0% likely

   CWE-697

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.